[Bug 26332] Applications should only use EME APIs on secure origins (e.g. HTTPS)

https://www.w3.org/Bugs/Public/show_bug.cgi?id=26332

--- Comment #42 from Ryan Sleevi <sleevi@google.com> ---
(In reply to Joe Steele from comment #41)
> (In reply to Ryan Sleevi from comment #39)
> > I think you're conflating two things.
> 
> What are the two things you think I am conflating?

"Rogue" CDMs and rogue intermediates.

I'm not sure I agree with the classification that there even is a "rogue CDM" -
it's clear from the CDMs already in existence that certain privacy properties
(or lack) are by-design of the CDM. Ergo, they're behaving exactly as that CDM
should - but in a way that is detrimental to the user.

The issue is that any intermediate can, for unprotected traffic, inject script
to use that CDM and report to an arbitrary party those results. That's just how
the web works.

Even if you normatively required prompting, any site which the user had
accepted (and I think we know what some of those sites those will, in practice,
be, given their representatives participation in the spec and this WG) can be
intercepted and used to track.

And it's not just when a UA visits one of these video sites - through the power
of the web (read iframe and related), an 'attacker' (hostile intermediate) can
inject the compromised video site into any site of the attackers choosing. This
was David's point [1] from the original report.

None of this has anything to do with "rogue CDMs". It's an inherent property of
the spec, and has nothing to do with "preventing rogue CDMs", but fundamentally
about protecting users.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.

Received on Tuesday, 19 August 2014 22:44:42 UTC